FunnelKit Automations: Unauthenticated PHP Object Injection in WordPress plugin
Summary
FunnelKit Automations, a WordPress marketing automation and CRM plugin, contains a deserialization flaw (CWE-502) that allows PHP Object Injection. The vulnerable path requires no login, so an unauthenticated remote attacker can potentially execute code on the server or tamper with data on websites running affected versions. The CNA scores the issue 9.8 (critical), while VulDB lists 7.3; Patchstack reports that it is expected to be exploited, but no known exploitation exists as of 1 Nov 2026.
Affected
- FunnelKit Automations (wp-marketing-automations) versions up to and including 3.8.6.1
- Vendor and version source: Patchstack and the CVE record
Fixed in
- Version 3.8.6.2 (per Patchstack and Positive Technologies; vendor changelog not yet confirmed)
Workaround
- No vendor-issued workaround known.
- If no update is possible: deactivate and remove the plugin, or restrict access to the REST API and admin paths at the web server or WAF (not verified against this issue).
Exploitation
- Not known to be exploited (as of 1 Nov 2026).
- Not listed in CISA KEV (as of 30 Oct 2026).
- No public proof of concept found in Metasploit, Exploit-DB or nuclei-templates (snapshot as of 30 Oct 2026).
- CISA SSVC: Automatable yes, Technical Impact total.
Our recommendation
- Update FunnelKit Automations to version 3.8.6.2 or later as soon as the fix is confirmed, ideally within days.
- Check which websites run the plugin, including test and staging sites.
- Review web server and application logs for unusual POST requests to the plugin's endpoints since the public disclosure.
- Monitor the Patchstack advisory, CISA KEV and NVD for updates on exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin page wordpress.org
- VulDB entry vuldb.com
- OffSeq radar (exploitation and PoC check) radar.offseq.com
- Positive Technologies (Vulners) PT-2026-133778 vulners.com
- CVE mirror cve.threatint.com cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:20.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.